Bsod got Memory.DMP whats causing it ?

Question

Bsod got Memory.DMP whats causing it ?

Anonymous

Got a windows 8.1 machine thats has a bsod and wont boot wont repair etc.

Got the memory.dmp from copying it in dos.

But i dont understand what i causing the pc not to boot and to give a bsod with error : 0xc000021a

Log :

Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64

Loading Dump File [F:\MEMORY.DMP]

Kernel Bitmap Dump File: Only kernel address space is available

************* Symbol Path validation summary **************

Response Time (ms) Location

Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 8 Kernel Version 9600 MP (4 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 9600.17085.amd64fre.winblue_gdr.140330-1035

Machine Name:

Kernel base = 0xfffff802b660e000 PsLoadedModuleList = 0xfffff802b68d82d0

Debug session time: Tue Aug 19 17:09:18.696 2014 (UTC + 2:00)

System Uptime: 0 days 0:00:46.431

Loading Kernel Symbols

...............................................................

...................................................

Loading User Symbols

..

Loading unloaded module list

..........

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {ffffc000bdd61710, ffffffffc0000428, ffffc000bc353e10, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+b69 )

Followup: MachineOwner

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)

The Winlogon process terminated unexpectedly.

Arguments:

Arg1: ffffc000bdd61710, String that identifies the problem.

Arg2: ffffffffc0000428, Error Code.

Arg3: ffffc000bc353e10

Arg4: 0000000000000000

Debugging Details:

ERROR_CODE: (NTSTATUS) 0xc000021a - {Onherstelbare systeemfout} Het systeemproces %hs is onverwacht afgebroken met de status: 0x%08x (0x%08x 0x%08x). Het systeem is afgesloten.

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Onherstelbare systeemfout} Het systeemproces %hs is onverwacht afgebroken met de status: 0x%08x (0x%08x 0x%08x). Het systeem is afgesloten.

EXCEPTION_PARAMETER1: ffffc000bdd61710

EXCEPTION_PARAMETER2: ffffffffc0000428

EXCEPTION_PARAMETER3: ffffc000bc353e10

EXCEPTION_PARAMETER4: 0

ADDITIONAL_DEBUG_TEXT: Verification of a KnownDLL failed.

BUGCHECK_STR: 0xc000021a_c0000428_gdi32.dll_HASH_INVALID

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: smss.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre

LAST_CONTROL_TRANSFER: from fffff802b698b779 to fffff802b6761fa0

STACK_TEXT:

ffffd0002094f5d8 fffff802b698b779 : 000000000000004c 00000000c000021a ffffd000238b7378 ffffe001a0d29180 : nt!KeBugCheckEx

ffffd0002094f5e0 fffff802b6983909 : ffffe0019f1b7b00 ffffd0002094f720 0000000000000000 0000000000000002 : nt!PopGracefulShutdown+0x2c9

ffffd0002094f620 fffff802b676d7b3 : 0006000000000000 0000000000000000 0000000000000000 ffffe0019f1b7880 : nt! ?? ::OKHAJAOM::`string'+0xb69

ffffd0002094f7c0 fffff802b6765c00 : fffff802b6b9d771 0000000000000001 ffffd0002094f9d8 00000000c0000004 : nt!KiSystemServiceCopyEnd+0x13

ffffd0002094f958 fffff802b6b9d771 : 0000000000000001 ffffd0002094f9d8 00000000c0000004 fffff802b68f4180 : nt!KiServiceLinkage

ffffd0002094f960 fffff802b6ad3853 : 0000000000000000 0000000000000000 fffff802b68f4180 ffffe0019f1b79c0 : nt! ?? ::NNGAKEGL::`string'+0x65101

ffffd0002094fa20 fffff802b6655fee : fffff802b6655f34 0000000000000000 0000000000000002 ffffe0019f1b7880 : nt!PopPolicyWorkerAction+0x63

ffffd0002094fa90 fffff802b6661adb : fffff80100000002 ffffd0002094fb50 0000000080000000 ffffe0019f1b7880 : nt!PopPolicyWorkerThread+0xba

ffffd0002094fad0 fffff802b66dd794 : 0000000000000000 ffffe0019f1b7880 ffffe0019f1b7880 ffffe0019e658900 : nt!ExpWorkerThread+0x293

ffffd0002094fb80 fffff802b67685c6 : ffffd00020580180 ffffe0019f1b7880 ffffe0019e664040 0000000000000000 : nt!PspSystemThreadStartup+0x58

ffffd0002094fbe0 0000000000000000 : ffffd00020950000 ffffd00020949000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:

nt! ?? ::OKHAJAOM::`string'+b69

fffff802`b6983909 cc int 3

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+b69

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 53388e13

BUCKET_ID_FUNC_OFFSET: b69

FAILURE_BUCKET_ID: 0xc000021a_c0000428_gdi32.dll_HASH_INVALID_nt!_??_::OKHAJAOM::_string_

BUCKET_ID: 0xc000021a_c0000428_gdi32.dll_HASH_INVALID_nt!_??_::OKHAJAOM::_string_

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc000021a_c0000428_gdi32.dll_hash_invalid_nt!_??_::okhajaom::_string_

FAILURE_ID_HASH: {a8bdd511-36e5-e64e-caf2-837379652eff}

Followup: MachineOwner

0: kd> lmvm nt

start end module name

fffff802b660e000 fffff802b6d97000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\074CDA55DA7246348FABA374422939411\ntkrnlmp.pdb

Loaded symbol image file: ntkrnlmp.exe

Image path: ntkrnlmp.exe

Image name: ntkrnlmp.exe

Timestamp: Sun Mar 30 23:35:15 2014 (53388E13)

CheckSum: 0071C6D7

ImageSize: 00789000

Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Answer 1

Hi Wesley,

Thank you for contacting Microsoft Community.

To guide in right direction I need some information.

1.Have you made any changes to the computer prior to this issue?

Cause: This error occurs when a user-mode subsystem, such as WinLogon or the Client

Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can

no longer be guaranteed. In response, the operating system switches to kernel

mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is

one of the few cases where the failure of a user-mode service can shut down the

system.

I will request you if any other external device is connected please disconnect and try booting the computer. If still you are getting BSOD please follow the methods below and check if it helps.

Method1:Reparing computer via built in Automatic Repair Tool.

1.Turn off the computer.

2,Press and hold "shift" key and press power button.

3.you will see options select "Troubleshoot".

4.select Advance options.

5.select Automatic Repair.

Once Automatic Repair is done your computer will restart automatically and check if computer is running now. If still issue is resolved refer the link below.

Method2:Resolving Blue Screen errors in Windows

Restore Windows to an earlier point in time

http://windows.microsoft.com/en-us/windows-8/resolve-windows-blue-screen-errors

**Disclaimer:**When you use System Restore to restore the computer to a previous state, programs and updates that you installed are removed.

Additional Information on 0xC000021A:

Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED

http://msdn.microsoft.com/en-us/library/windows/hardware/ff560177(v=vs.85).aspx

Hope this information is helpful. Please do let us know if you need further assistance, we’ll be glad to assist you.

Answer 2

Anonymous

Any one please ?

0 comments

Share via

Bsod got Memory.DMP whats causing it ?

2 answers